MITRE ATT&CKcampaign
C0046 ArcaneDoor
- Domain
- enterprise
- Version
- 1.0
- Created
- 2025-01-06
Description
ArcaneDoor is a campaign targeting networking devices from Cisco and other vendors between July 2023 and April 2024, primarily focused on government and critical infrastructure networks. ArcaneDoor is associated with the deployment of the custom backdoors Line Runner and Line Dancer. ArcaneDoor is attributed to a group referred to as UAT4356 or STORM-1849, and is assessed to be a state-sponsored campaign.
Related
Uses · MITRE ATT&CK (27)
- T1685 Disable or Modify Tools technique
- T1690 Prevent Command History Logging technique
- S1186 Line Dancer software (malware)
- S1188 Line Runner software (malware)
- T1653 Power Settings technique
- T1583.003 Virtual Private Server sub-technique
- T1583.006 Web Services sub-technique
- T1587.001 Malware sub-technique
- T1587.003 Digital Certificates sub-technique
- T1071.001 Web Protocols sub-technique
- T1102.003 One-Way Communication sub-technique
- T1556 Modify Authentication Process technique
- T1557 Adversary-in-the-Middle technique
- T1070.004 File Deletion sub-technique
- T1190 Exploit Public-Facing Application technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1014 Rootkit technique
- T1020 Automated Exfiltration technique
- T1036 Masquerading technique
- T1037 Boot or Logon Initialization Scripts technique
- T1040 Network Sniffing technique
- T1041 Exfiltration Over C2 Channel technique
- T1055 Process Injection technique
- T1059 Command and Scripting Interpreter technique
- T1082 System Information Discovery technique
- T1119 Automated Collection technique
- T1133 External Remote Services technique